WEBVTT 00:00:04.819 --> 00:00:07.599 You're listening to a stage talk titled Chinese 00:00:07.599 --> 00:00:10.419 influence operations and disinformation campaigns. 00:00:10.919 --> 00:00:12.900 This week we were joined by DoubleThink Labs 00:00:12.900 --> 00:00:15.880 Jasper Hewitt as we explored the new forms of 00:00:15.880 --> 00:00:18.879 propaganda. We discussed spam of large operations 00:00:18.879 --> 00:00:22.019 in the US elections to AI influencers pushing 00:00:22.019 --> 00:00:25.039 state lines on TikTok, along with some tool and 00:00:25.039 --> 00:00:27.989 reading recommendations along the way. This talk 00:00:27.989 --> 00:00:30.530 was hosted by me, Charlotte Ma, on Thursday the 00:00:30.530 --> 00:00:34.549 8th of May 2025 in the Bellencat Discord server. 00:00:50.630 --> 00:00:55.380 Well, for another stage talk. This week, we're 00:00:55.380 --> 00:00:58.359 speaking about digital influence operations and 00:00:58.359 --> 00:01:01.979 disinformation campaigns. An MIT study back in 00:01:01.979 --> 00:01:05.599 2018, which feels like forever ago, found that 00:01:05.599 --> 00:01:09.200 fake news was 70 % more likely to be retweeted 00:01:09.200 --> 00:01:12.140 on Twitter than real news. And that was before 00:01:12.140 --> 00:01:14.939 Musk's takeover. So you can imagine what that 00:01:14.939 --> 00:01:17.879 looks like now. While state -led influence operations 00:01:17.879 --> 00:01:20.219 have happened for years, but the use of internet, 00:01:20.459 --> 00:01:23.000 and in particular social media, as a means of 00:01:23.000 --> 00:01:25.500 running information operations has grown prominently 00:01:25.500 --> 00:01:28.420 over the past decade. The Chinese Communist Party 00:01:28.420 --> 00:01:31.219 is one such political power that uses digital 00:01:31.219 --> 00:01:33.400 influence operations and disinformation campaigns 00:01:33.400 --> 00:01:35.719 to advance the party's interests in the region 00:01:35.719 --> 00:01:39.260 and further afield. Jasper Hewitt joins us here 00:01:39.260 --> 00:01:42.219 from DoubleThinkLab. DoubleThinkLab researches 00:01:42.219 --> 00:01:45.000 malign Chinese influence operations and disinformation 00:01:45.000 --> 00:01:47.859 campaigns and their impacts via the digital tools 00:01:47.859 --> 00:01:50.500 and methodologies they have developed. As an 00:01:50.500 --> 00:01:53.200 analyst, Jasper's focus has been on PRC influence 00:01:53.200 --> 00:01:55.620 operations during the Taiwanese and US elections, 00:01:55.840 --> 00:01:58.079 and he's currently investigating how official 00:01:58.079 --> 00:02:01.180 PRC accounts use the MetaAd library to expand 00:02:01.180 --> 00:02:04.280 their content's reach. We'll jump into all of 00:02:04.280 --> 00:02:06.900 that in a second. But first, a short reminder, 00:02:07.359 --> 00:02:09.580 if you'd like to ask a question, please do so 00:02:09.580 --> 00:02:13.020 in the chat as we talk. And please note within 00:02:13.020 --> 00:02:15.740 your question, if you do not want me to read 00:02:15.740 --> 00:02:18.680 your username out, as this is being audio recorded 00:02:18.680 --> 00:02:23.159 and will appear on podcast platforms. Okay. Jasper, 00:02:23.280 --> 00:02:26.199 before questions, can you tell us a little bit 00:02:26.199 --> 00:02:29.039 more about your work? And while you do so, I 00:02:29.039 --> 00:02:33.060 will mute. Yes, so first of all, thank you for 00:02:33.060 --> 00:02:35.379 that great introduction and thanks for having 00:02:35.379 --> 00:02:37.379 us, having Double Think Lab here. This is a great 00:02:37.379 --> 00:02:40.740 opportunity to talk to the whole community. So 00:02:40.740 --> 00:02:43.740 yeah, as she just said, Double Think Lab is a 00:02:43.740 --> 00:02:46.780 Taiwanese organization. We're an NGO and we've 00:02:46.780 --> 00:02:49.919 been founded in 2019 and yeah, we mostly conduct 00:02:49.919 --> 00:02:53.840 research into PRC influence operations. Now, 00:02:53.860 --> 00:02:56.879 I'm on the digital intelligence team, so I'm 00:02:56.879 --> 00:02:59.520 mainly responsible for tracking and reporting 00:02:59.520 --> 00:03:02.819 on all of the inauthentic accounts. And we're 00:03:02.819 --> 00:03:05.759 also developing automated tools to track these 00:03:05.759 --> 00:03:08.560 accounts because, of course, this is a very time 00:03:08.560 --> 00:03:11.500 consuming work. So if we can automate it, then 00:03:11.500 --> 00:03:14.060 we do that wherever possible. But I can talk 00:03:14.060 --> 00:03:18.719 about that more in the Q &A. So yeah, today I 00:03:18.719 --> 00:03:20.900 just want to give you first say a few things 00:03:20.900 --> 00:03:23.580 about FEMI or influence operations and how that's 00:03:23.580 --> 00:03:26.139 different from fake news and disinformation. 00:03:26.620 --> 00:03:28.759 And then I just want to give you a crash course 00:03:28.759 --> 00:03:31.860 into PRC influence operations. So we're going 00:03:31.860 --> 00:03:33.840 to talk about spamouflage, which is the biggest 00:03:33.840 --> 00:03:37.300 one. And I'm going to tell you about how spamouflage 00:03:37.300 --> 00:03:42.729 has been evolving over the last few years. Yeah, 00:03:42.870 --> 00:03:45.169 FEMI. So FEMI stands for Foreign Information 00:03:45.169 --> 00:03:47.469 Manipulation and Interference. It's a very long 00:03:47.469 --> 00:03:49.789 name, but it's basically a different term for 00:03:49.789 --> 00:03:52.509 foreign influence operation. Now the key term 00:03:52.509 --> 00:03:55.729 there is foreign. So we're mostly concerned with 00:03:55.729 --> 00:03:58.870 information that goes from one country to another 00:03:58.870 --> 00:04:02.189 and then tries to influence the political debate 00:04:02.189 --> 00:04:07.759 in that second country. Femi is different from 00:04:07.759 --> 00:04:10.900 fake news and disinformation because not all 00:04:10.900 --> 00:04:14.800 influence operations are disinformation. So people 00:04:14.800 --> 00:04:16.720 can say something that is true, right? You can 00:04:16.720 --> 00:04:19.620 just say like, oh, I really like that political 00:04:19.620 --> 00:04:22.540 candidate. And that's not necessarily fake news, 00:04:23.019 --> 00:04:26.600 but we care mostly about the method. That's something 00:04:27.230 --> 00:04:29.290 how information is spread. So we're looking for 00:04:29.290 --> 00:04:31.769 coordinated inauthentic behavior. So it's methods 00:04:31.769 --> 00:04:34.410 over over content. So if we find that there's 00:04:34.410 --> 00:04:37.069 like a thousand inauthentic accounts saying, 00:04:37.149 --> 00:04:40.129 for example, that BYD is an amazing company, 00:04:40.389 --> 00:04:42.930 then that would be a reason for us to to investigate. 00:04:43.990 --> 00:04:47.329 Now, if we look at PRC influence operations, 00:04:47.709 --> 00:04:50.610 there's several actors that are involved in this. 00:04:50.649 --> 00:04:53.329 So obviously, there's the PRC state media, right? 00:04:53.689 --> 00:04:55.829 This is really big and they all have they're 00:04:55.829 --> 00:04:59.199 all very active on social media on several platforms. 00:04:59.980 --> 00:05:02.279 And then there's influencers. Now, some of these 00:05:02.279 --> 00:05:05.540 influencers have direct ties to the PRC government 00:05:05.540 --> 00:05:08.899 with some influencers. It's not as clear if they 00:05:08.899 --> 00:05:11.920 have ties to the PRC government, but people suspect 00:05:11.920 --> 00:05:14.360 that they do. And then there's spamouflage. So 00:05:14.360 --> 00:05:19.199 that's tens of thousands of, if not more, fake 00:05:19.199 --> 00:05:23.000 accounts that are basically just spamming the 00:05:23.000 --> 00:05:27.529 internet with pro -PRC messages. So, yeah, spam 00:05:27.529 --> 00:05:30.790 has been defined as a massive cross -platform 00:05:30.790 --> 00:05:33.810 propaganda infrastructure. It was first discovered 00:05:33.810 --> 00:05:38.709 by Grafica in 2019. So Ben Nemo actually gave 00:05:38.709 --> 00:05:42.329 it the name spam because they would camouflage 00:05:42.329 --> 00:05:46.209 their propaganda with spam. So, yeah, you wouldn't 00:05:46.209 --> 00:05:48.490 only see propaganda. It would be like pictures 00:05:48.490 --> 00:05:50.949 of beautiful scenery or pictures of attractive 00:05:50.949 --> 00:05:53.430 individuals or random book quotes. And then suddenly 00:05:53.430 --> 00:06:00.120 there would be this PRC propaganda. Now in 2023, 00:06:00.620 --> 00:06:03.720 Metta actually attributed spammaflage to PRC 00:06:03.720 --> 00:06:06.160 law enforcement. So this was a very important 00:06:06.160 --> 00:06:10.019 finding, but it basically it basically proved 00:06:10.019 --> 00:06:11.819 what everybody was already thinking, right? Because 00:06:11.819 --> 00:06:14.100 all of this stuff was so pro -PRC that there 00:06:14.100 --> 00:06:17.420 could really be only be one entity behind it. 00:06:18.500 --> 00:06:21.240 Now, what is the camouflage saying? Because this 00:06:21.240 --> 00:06:23.220 has also changed over time. At the beginning, 00:06:23.399 --> 00:06:26.319 they were mostly concerned with issues that are 00:06:26.319 --> 00:06:30.019 sensitive to the PRC. So for example, prominent 00:06:30.019 --> 00:06:32.779 dissident Guo Wengui, he was targeted at the 00:06:32.779 --> 00:06:35.620 start, and then Hong Kong with the protests, 00:06:36.480 --> 00:06:40.009 COVID, and then also Xinjiang and Tibet. But 00:06:40.009 --> 00:06:43.069 over time, the campaign just became more overall 00:06:43.069 --> 00:06:46.910 pro PRC, anti -west. They started going after 00:06:46.910 --> 00:06:49.750 specific countries. So the USA is obviously a 00:06:49.750 --> 00:06:53.329 big target. Taiwan is a very big target. I think 00:06:53.329 --> 00:06:55.449 we're right at the forefront here in Taiwan. 00:06:56.050 --> 00:06:59.470 And then Japan, the Philippines, maritime disputes. 00:07:00.410 --> 00:07:03.089 These are all topics that Spamouflage is touching 00:07:03.089 --> 00:07:06.209 on. So, for example, during the US elections, 00:07:06.370 --> 00:07:08.500 these accounts were also very active. And they 00:07:08.500 --> 00:07:11.879 were basically criticizing domestic issues, but 00:07:11.879 --> 00:07:14.500 also US foreign policy, like, for example, US 00:07:14.500 --> 00:07:17.540 support for Israel, for Ukraine. And they were 00:07:17.540 --> 00:07:21.420 critical of both presidential candidates. They're 00:07:21.420 --> 00:07:25.740 also going after individuals, so specific dissidents, 00:07:25.920 --> 00:07:28.040 also smaller dissidents, not just the super high 00:07:28.040 --> 00:07:30.540 profile ones. They're all being targeted by this 00:07:30.540 --> 00:07:33.279 campaign. So their social media accounts, sometimes 00:07:33.279 --> 00:07:35.879 in the comment sections, you'll read a lot of 00:07:35.879 --> 00:07:38.000 hate comments. And those are also attributed 00:07:38.000 --> 00:07:42.699 to this camouflage. Now, what do these accounts 00:07:42.699 --> 00:07:44.319 look like? So I'm going to talk a little bit 00:07:44.319 --> 00:07:47.379 about how they operate. And then you can maybe 00:07:47.379 --> 00:07:49.879 also use some of that info to find these accounts 00:07:49.879 --> 00:07:52.819 yourself if you're interested in it. So many 00:07:52.819 --> 00:07:55.060 of these accounts, they would use profile photos 00:07:55.060 --> 00:07:58.339 of women, mostly Asian women. And many of these 00:07:58.339 --> 00:08:03.040 photos have been taken from small Chinese influencers. 00:08:03.879 --> 00:08:06.079 So I personally think this is really messed up 00:08:06.079 --> 00:08:08.000 because these people, technically speaking, cannot 00:08:08.000 --> 00:08:10.860 use Western platforms themselves. But then an 00:08:10.860 --> 00:08:13.220 influence operation attributed to their government 00:08:13.220 --> 00:08:16.779 is taking their photos to put them out there 00:08:16.779 --> 00:08:22.180 on these Western platforms. The accounts mostly 00:08:22.180 --> 00:08:26.399 swarm around the larger state media accounts 00:08:26.399 --> 00:08:29.829 and also influencers. So if you look at some 00:08:29.829 --> 00:08:32.690 state media accounts or accounts from diplomats, 00:08:32.929 --> 00:08:35.389 for example, Zhang Heqing is a big one. He used 00:08:35.389 --> 00:08:37.730 to be the diplomat to Pakistan, and now he's 00:08:37.730 --> 00:08:40.789 a big personality on X. And if you go through 00:08:40.789 --> 00:08:43.570 his posts and you look at his retweets, most 00:08:43.570 --> 00:08:47.429 of it will be, you will see his camouflage. Now, 00:08:48.110 --> 00:08:50.870 these accounts usually have a division of labor. 00:08:51.250 --> 00:08:53.409 So there's like cedars and then there's amplifiers. 00:08:53.820 --> 00:08:56.840 So seeders would post the initial content, and 00:08:56.840 --> 00:09:00.039 then there's like 20 amplifiers below that, that 00:09:00.039 --> 00:09:04.039 their only job is just to repost that. We think 00:09:04.039 --> 00:09:07.360 that the accounts are side work accounts, so 00:09:07.360 --> 00:09:10.519 to say. So they're like hardly operated by scripts, 00:09:10.539 --> 00:09:13.240 but they're also definitely real people behind 00:09:13.240 --> 00:09:15.759 it. So we know that there's real people behind 00:09:15.759 --> 00:09:19.360 it because they are actually most active during 00:09:19.360 --> 00:09:23.179 PRC working hours. So if you... plot their activity, 00:09:23.240 --> 00:09:27.120 you will see that's from nine to five in PRC 00:09:27.120 --> 00:09:28.820 working time. And then they also have a lunch 00:09:28.820 --> 00:09:31.200 break between 12 and two. So you can actually 00:09:31.200 --> 00:09:35.700 see that activity drop. So sometimes they'll 00:09:35.700 --> 00:09:38.460 also make robotic posts. So for example, sometimes 00:09:38.460 --> 00:09:40.759 at the beginning, there's robotic boot quotes 00:09:40.759 --> 00:09:42.519 when the accounts just start. And those also 00:09:42.519 --> 00:09:44.820 happen outside of working hours. Because obviously, 00:09:44.860 --> 00:09:48.120 when you run a script, there's no need to be 00:09:48.120 --> 00:09:52.429 in the office. If you think of a fake account, 00:09:52.590 --> 00:09:54.850 then many people might think of an account that 00:09:54.850 --> 00:10:00.149 was just created the other day and has very little 00:10:00.149 --> 00:10:02.110 followers or something. But we actually found 00:10:02.110 --> 00:10:04.750 that many of the, specifically the Cedar accounts, 00:10:05.330 --> 00:10:09.409 they were created like back in 2012, 2011, and 00:10:09.409 --> 00:10:12.389 they have huge followings. So we found some accounts 00:10:12.389 --> 00:10:15.590 that have more than 70 ,000 followers, 50 ,000 00:10:15.590 --> 00:10:18.460 followers. And it's not that The PRC was very 00:10:18.460 --> 00:10:20.919 early with making all of these accounts. We found 00:10:20.919 --> 00:10:22.759 that actually many of them have been hacked. 00:10:22.980 --> 00:10:26.320 So those were inactive accounts that haven't 00:10:26.320 --> 00:10:29.440 been used for a very long time. And then they 00:10:29.440 --> 00:10:31.919 got hacked, and then they probably got sold to 00:10:31.919 --> 00:10:35.320 the people running Spamouflage. So one funny 00:10:35.320 --> 00:10:37.259 example with an account that we were tracking 00:10:37.259 --> 00:10:40.220 during the US election is when we finally get 00:10:40.220 --> 00:10:42.580 to get all of their posts through the API, we 00:10:42.580 --> 00:10:46.039 found that back in 2011, this account belonged 00:10:46.039 --> 00:10:48.980 to a radio show in Texas. And then after that, 00:10:48.980 --> 00:10:52.159 it was just inactive for like 12 years. And then 00:10:52.159 --> 00:10:57.879 suddenly it became a spamflash account. We also 00:10:57.879 --> 00:11:00.659 found that these accounts appear to buy third 00:11:00.659 --> 00:11:04.240 party, like retweet amplification, especially 00:11:04.240 --> 00:11:08.059 on X. So during our investigation, we found over 00:11:08.059 --> 00:11:11.879 a thousand accounts that artificially boost these 00:11:11.879 --> 00:11:15.720 spamflash posts. And these accounts were actually 00:11:15.720 --> 00:11:18.659 crypto accounts and Web3 accounts that normally 00:11:18.659 --> 00:11:22.600 speaking have a lot of, normally speaking, all 00:11:22.600 --> 00:11:25.480 of their reposts are of like large crypto accounts 00:11:25.480 --> 00:11:30.559 like ChainGBT or London Real TV. So it was really 00:11:30.559 --> 00:11:32.840 interesting to see that. in those timelines, 00:11:33.000 --> 00:11:35.080 suddenly you would see these spam of flash posts 00:11:35.080 --> 00:11:37.620 popping up. So there's some interesting dynamics 00:11:37.620 --> 00:11:39.840 going on there. It's not like they do everything 00:11:39.840 --> 00:11:42.539 in house. There's definitely some collaboration 00:11:42.539 --> 00:11:46.580 going on with spam companies, potentially also 00:11:46.580 --> 00:11:50.759 from other countries. Now, spam of flash is notoriously 00:11:50.759 --> 00:11:53.799 ineffective. So many researchers say that spam 00:11:53.799 --> 00:11:57.259 of flash has failed to get a lot of authentic. 00:11:59.209 --> 00:12:02.490 authentic interaction over time. So yeah, what 00:12:02.490 --> 00:12:05.570 I just said, they buy their retweets, many of 00:12:05.570 --> 00:12:07.649 their followers and their retweets or other spam 00:12:07.649 --> 00:12:09.730 of flash accounts. So yeah, should we really 00:12:09.730 --> 00:12:12.350 be caring about this? Well, today I'm here to 00:12:12.350 --> 00:12:14.970 say that, yes, I think we should keep caring 00:12:14.970 --> 00:12:18.950 about spam of flash because it is evolving and 00:12:18.950 --> 00:12:22.809 they are definitely trying to find new ways to 00:12:22.809 --> 00:12:24.909 become more relevant. So I'm now going to share. 00:12:25.389 --> 00:12:29.889 two or three examples of what we found in which 00:12:29.889 --> 00:12:31.909 we can see that spam of flash is becoming more 00:12:31.909 --> 00:12:34.929 relevant, I think. So during the U .S. elections, 00:12:35.230 --> 00:12:37.649 they were continuing what they were always doing, 00:12:38.090 --> 00:12:40.789 like posting a lot of pro -PRC stuff and saying 00:12:40.789 --> 00:12:43.929 some critical things about the United States. 00:12:43.929 --> 00:12:46.850 But we also saw something new. And this was called 00:12:46.850 --> 00:12:49.149 MegaFlash. So there were these spam of flash 00:12:49.149 --> 00:12:52.250 accounts that were impersonating Trump supporters. 00:12:52.639 --> 00:12:55.080 And this was first discovered by Elise Tomas 00:12:55.080 --> 00:12:59.360 at the Institute for Strategic Dialogue. And 00:12:59.360 --> 00:13:02.679 yeah, there were these accounts that really pretended 00:13:02.679 --> 00:13:05.559 to be American. So they had like in their bio, 00:13:05.639 --> 00:13:07.659 they had like all these American flags and said 00:13:07.659 --> 00:13:10.840 like stuff like hashtag NRA and stuff like that. 00:13:13.100 --> 00:13:16.580 They were interesting because it was harder to 00:13:16.580 --> 00:13:18.460 prove that they were connected to spamaflash. 00:13:18.779 --> 00:13:21.440 So whereas normally speaking, spamaflash is very 00:13:21.440 --> 00:13:23.320 straightforward. They just post a lot of pro 00:13:23.320 --> 00:13:27.500 -PRC stuff. So it's very easy to kind of see 00:13:27.500 --> 00:13:31.220 where their allegiance lies. But then with these 00:13:31.220 --> 00:13:33.700 accounts, they didn't post any pro -PRC stuff. 00:13:33.799 --> 00:13:36.879 They just posted pro -Trump stuff, which was 00:13:36.879 --> 00:13:39.690 really weird. We were tracking a bunch of these 00:13:39.690 --> 00:13:42.429 accounts and we already had the idea that maybe 00:13:42.429 --> 00:13:44.610 these accounts were connected to the campaign 00:13:44.610 --> 00:13:49.570 because some of the crypto accounts were also 00:13:49.570 --> 00:13:53.850 amplifying these accounts. And then their posting 00:13:53.850 --> 00:13:56.129 times were also in PRC working times, even though 00:13:56.129 --> 00:13:58.750 they all claimed to be Americans, which is weird 00:13:58.750 --> 00:14:00.269 because that would be the middle of the night 00:14:00.269 --> 00:14:04.100 in the United States. And then, at some point, 00:14:04.279 --> 00:14:06.279 they made this... So, Sprimal Flies is very clumsy. 00:14:06.419 --> 00:14:08.500 They sometimes make very clumsy mistakes. And 00:14:08.500 --> 00:14:11.679 then, at some point, like seven out of the 15 00:14:11.679 --> 00:14:13.320 accounts that we were tracking, they suddenly 00:14:13.320 --> 00:14:17.399 posted this account in Chinese criticizing the 00:14:17.399 --> 00:14:19.639 Falun Gong, which was just completely out of 00:14:19.639 --> 00:14:21.860 context of what they were doing before. And I 00:14:21.860 --> 00:14:24.360 think after that, they kind of realized that 00:14:24.360 --> 00:14:26.460 the batch was compromised. They just left those 00:14:26.460 --> 00:14:29.100 accounts and they haven't been used since. So, 00:14:29.179 --> 00:14:31.700 these accounts are still online. If you go through 00:14:31.700 --> 00:14:34.259 our US election report, then you can find the 00:14:34.259 --> 00:14:38.340 account name. Now, another thing, one specifically 00:14:38.340 --> 00:14:41.679 interesting account, it goes by the name of Edward 00:14:41.679 --> 00:14:45.019 D. Mayer. It's also still going today, even though 00:14:45.019 --> 00:14:49.320 we've reported on it many times. This account 00:14:49.320 --> 00:14:51.960 actually became really relevant. I think it's 00:14:51.960 --> 00:14:53.899 been the most successful spam camouflage account 00:14:53.899 --> 00:14:56.360 that we've been tracking over the last few months. 00:14:56.720 --> 00:15:00.379 So this account actually gamed the whole X algorithm 00:15:00.379 --> 00:15:03.460 by posting Street Fight videos. So instead of 00:15:03.460 --> 00:15:07.840 boring spam, like some scenery, this account 00:15:07.840 --> 00:15:10.480 found that if he posts Street Fight videos, then 00:15:10.480 --> 00:15:13.879 the algorithm just boosts his posts. So he got 00:15:13.879 --> 00:15:16.299 some Street Fight videos for which he got like 00:15:16.299 --> 00:15:20.000 9 million views. And this kind of spilled over 00:15:20.000 --> 00:15:22.480 to some of the propaganda posts that he would 00:15:22.480 --> 00:15:25.370 make. So on some of the propaganda posts, he 00:15:25.370 --> 00:15:28.769 would get like 100 ,000 views. Now, this is a 00:15:28.769 --> 00:15:31.909 very weak spillover, but still a very big difference 00:15:31.909 --> 00:15:34.370 from what Spamouflage usually gets in terms of 00:15:34.370 --> 00:15:37.230 interaction. So with the other Spamouflage accounts, 00:15:37.350 --> 00:15:40.529 we maybe look at like 10 ,000 views, 15 ,000 00:15:40.529 --> 00:15:42.850 views on a good day, and then 20 ,000 views would 00:15:42.850 --> 00:15:46.049 be like the jackpot, at least for what we check. 00:15:46.190 --> 00:15:48.610 But this account really managed to game the algorithm. 00:15:49.720 --> 00:15:54.759 and found a very interesting way to become more 00:15:54.759 --> 00:15:58.519 relevant. At some point, this account got a warning 00:15:58.519 --> 00:16:02.519 label to its account from X saying that it was 00:16:02.519 --> 00:16:04.879 posting violent content and that influenced how 00:16:04.879 --> 00:16:09.279 it got recommended by the algorithm. After that, 00:16:09.620 --> 00:16:13.460 the account became irrelevant again. But he still 00:16:13.460 --> 00:16:15.820 continued like he created a few new accounts 00:16:15.820 --> 00:16:18.740 that I think were done by the same operator. 00:16:19.240 --> 00:16:22.159 And he also created like an X community, which 00:16:22.159 --> 00:16:24.360 was also interesting to see sort of trying out 00:16:24.360 --> 00:16:27.500 all these new functions. And this account was 00:16:27.500 --> 00:16:31.539 also actively replying to authentic users with 00:16:31.539 --> 00:16:33.500 large following. So he was just like talking 00:16:33.500 --> 00:16:36.379 to some people and saying stuff about immigration 00:16:36.379 --> 00:16:38.440 and then people would actually respond to it 00:16:38.440 --> 00:16:42.860 and go into into dialogue with it. So, yeah, 00:16:43.019 --> 00:16:45.019 this was a very interesting finding, and it shows 00:16:45.019 --> 00:16:48.519 that Spamouflage, they don't sit still and stay 00:16:48.519 --> 00:16:51.000 irrelevant. They really look for ways to become 00:16:51.000 --> 00:16:53.740 more relevant. Now, another thing that they've 00:16:53.740 --> 00:16:57.279 been doing is experimenting with artificial intelligence, 00:16:57.340 --> 00:17:00.799 of course. So I'm happy to talk more about that 00:17:00.799 --> 00:17:05.660 in the Q &A, because it's a big topic. But yeah, 00:17:05.779 --> 00:17:08.079 another thing that they've been doing is experimenting 00:17:08.079 --> 00:17:11.779 with new platforms. So there's a lot of new platforms 00:17:11.779 --> 00:17:15.319 popping up, right? Blue Sky, Threads, and especially 00:17:15.319 --> 00:17:18.420 Threads is huge in Taiwan. I think for now, for 00:17:18.420 --> 00:17:20.960 young people, Threads is probably the most important 00:17:20.960 --> 00:17:25.599 platform in Taiwan. And Taiwan is going through 00:17:25.599 --> 00:17:31.460 some political challenges right now. Yeah, there 00:17:31.460 --> 00:17:35.400 have been a lot of influence operations from 00:17:35.400 --> 00:17:37.940 spam of flash targeted at Taiwan, specifically 00:17:37.940 --> 00:17:42.160 at the ruling party right now. So in this case, 00:17:42.180 --> 00:17:45.259 we also see a similar pattern. So also the spam 00:17:45.259 --> 00:17:47.779 of flash pattern, like spam and then propaganda. 00:17:48.279 --> 00:17:51.279 But it's more like the mega flash. It's not overly 00:17:51.279 --> 00:17:54.180 pro -PRC because they know that most Taiwanese 00:17:54.180 --> 00:17:56.180 people don't necessarily associate with that. 00:17:56.400 --> 00:17:59.220 So it's more toned down. It's more like with 00:17:59.220 --> 00:18:02.880 the mega flash. They're only posting specific 00:18:02.880 --> 00:18:06.240 political messages that they think people might 00:18:06.240 --> 00:18:10.480 associate themselves with. And some of these 00:18:10.480 --> 00:18:13.480 posts actually already reached more than 80 ,000 00:18:13.480 --> 00:18:16.819 views and 9 ,000 likes on the political posts. 00:18:16.839 --> 00:18:19.759 So this is very, very high compared to what we 00:18:19.759 --> 00:18:22.579 saw on X. This might also be related because 00:18:22.579 --> 00:18:25.039 the threats algorithm just works differently. 00:18:26.740 --> 00:18:30.359 And yeah, on Blue Sky, we've also seen a few 00:18:30.359 --> 00:18:32.680 spam of large accounts popping up. And Blue Sky 00:18:32.680 --> 00:18:34.839 is particularly interesting because it has a 00:18:34.839 --> 00:18:36.880 really good open API. I don't know if anyone 00:18:36.880 --> 00:18:40.180 played around with it yet, but Blue Sky is just 00:18:40.180 --> 00:18:43.180 the ultimate platform to create an army of bots 00:18:43.180 --> 00:18:47.740 and just let it run. So yeah, but nobody is really 00:18:47.740 --> 00:18:50.380 using it yet or not enough people are using it 00:18:50.380 --> 00:18:54.400 yet. So if everybody switches to Blue Sky tomorrow, 00:18:54.500 --> 00:18:56.930 that would be very interesting. And also, It's 00:18:56.930 --> 00:19:00.210 also a lot easier to do analysis on Blue Sky 00:19:00.210 --> 00:19:03.690 because the biggest challenge, I think, in this 00:19:03.690 --> 00:19:05.890 work has been that all of the platforms are closing 00:19:05.890 --> 00:19:10.009 down their access to researchers. So CrowdTangle 00:19:10.009 --> 00:19:12.109 disappeared, right? Got replaced by the content 00:19:12.109 --> 00:19:16.950 library, but it's not the same. And the X API 00:19:16.950 --> 00:19:20.809 is, yeah, basically completely closed off, right? 00:19:20.829 --> 00:19:22.960 You have to pay a lot of money. I think if you 00:19:22.960 --> 00:19:25.039 want to get a million tweets per month now, you 00:19:25.039 --> 00:19:27.740 need to pay five thousand USD a month. And in 00:19:27.740 --> 00:19:30.019 the past, a researcher could get two million 00:19:30.019 --> 00:19:37.059 tweets per month for free. So, yeah. And TikTok 00:19:37.059 --> 00:19:39.440 is also a challenge in itself because the video 00:19:39.440 --> 00:19:44.119 format is just, yeah, kind of a pain in the ass 00:19:44.119 --> 00:19:46.420 to find information, especially because their 00:19:46.420 --> 00:19:48.680 search function is very incomplete. If you just 00:19:48.680 --> 00:19:50.940 typed like. if you do a keyword search, then 00:19:50.940 --> 00:19:53.220 it just gives you like 10 random videos or 20 00:19:53.220 --> 00:19:55.900 random videos from random years that it thinks 00:19:55.900 --> 00:19:58.779 you might be most interested in. So it's very 00:19:58.779 --> 00:20:01.900 difficult to do like exhaustive research there. 00:20:03.180 --> 00:20:06.259 So yeah, I think that's it for me and we can 00:20:06.259 --> 00:20:11.339 go to the Q &A. Amazing. Thank you. Yeah, I think 00:20:11.339 --> 00:20:13.980 most people within this audience or at least 00:20:13.980 --> 00:20:17.440 in the Bellicat staff side have experienced that 00:20:17.440 --> 00:20:21.619 frustration with the the tools closing down to 00:20:21.619 --> 00:20:24.539 monitor social media sites. Before going to audience 00:20:24.539 --> 00:20:27.539 questions, I was intrigued actually to ask you 00:20:27.539 --> 00:20:29.420 what the differences are, particularly as we've 00:20:29.420 --> 00:20:33.819 got such a research -based audience. What's unique 00:20:33.819 --> 00:20:36.880 about researching Chinese disinformation campaigns 00:20:36.880 --> 00:20:40.160 in comparison, for example, with US state -led 00:20:40.160 --> 00:20:43.740 disinfo or Russian state -led disinfo campaigns? 00:20:44.180 --> 00:20:47.920 Are there any unique obstacles or anything that 00:20:48.619 --> 00:20:51.799 researchers who are used to looking at, for example, 00:20:52.039 --> 00:20:54.740 Russian propaganda might be surprised to encounter 00:20:54.740 --> 00:20:59.039 when it comes to Chinese propaganda. Yeah, I 00:20:59.039 --> 00:21:03.119 have to be really honest in that I don't know 00:21:03.119 --> 00:21:06.339 enough necessarily about the Russian disinfo 00:21:06.339 --> 00:21:08.180 campaigns. This is something that I know that 00:21:08.180 --> 00:21:11.900 I should get more into, but I keep postponing 00:21:11.900 --> 00:21:17.920 it. I think perhaps the language element, the 00:21:17.920 --> 00:21:22.940 language aspect is very unique, maybe, to the 00:21:22.940 --> 00:21:25.880 Chinese influence operations. In the beginning, 00:21:26.420 --> 00:21:29.539 many of these accounts would post a lot in Chinese, 00:21:30.220 --> 00:21:33.180 but then now they're slowly using more English. 00:21:33.460 --> 00:21:37.960 Also, now there's AI, so it's more easy to just 00:21:37.960 --> 00:21:39.940 translate, oh, so there's less language mistakes. 00:21:40.420 --> 00:21:43.170 But if you're looking at influence operations 00:21:43.170 --> 00:21:46.569 from the PRC towards Taiwan, which is interesting 00:21:46.569 --> 00:21:48.670 because they both technically use the same language, 00:21:48.990 --> 00:21:51.329 right? But then there's a difference in the characters 00:21:51.329 --> 00:21:54.009 that Taiwan and China use. So Taiwan uses the 00:21:54.009 --> 00:21:56.769 traditional characters and China uses simplified 00:21:56.769 --> 00:22:02.779 characters. look for in posts that we think might 00:22:02.779 --> 00:22:06.160 come from the PRC is we're looking for mistakes 00:22:06.160 --> 00:22:08.779 in the conversion in the conversion between those 00:22:08.779 --> 00:22:11.579 characters. So many PRC threat actors, they will 00:22:11.579 --> 00:22:14.380 write a post in simplified and then they'll throw 00:22:14.380 --> 00:22:17.440 it through software to convert it to traditional 00:22:17.440 --> 00:22:19.539 characters. And then there's always mistakes 00:22:19.539 --> 00:22:23.599 there. So, yeah, we're kind of like always looking 00:22:23.599 --> 00:22:25.920 for these simplified characters that might give 00:22:25.920 --> 00:22:32.079 us a hint. Yeah, absolutely. You can often find, 00:22:32.079 --> 00:22:36.339 for example, with Russian disinfo campaigns as 00:22:36.339 --> 00:22:41.019 well, language, even in translated English, can 00:22:41.019 --> 00:22:44.559 help you spot if something is potentially misleading 00:22:44.559 --> 00:22:46.460 or not, because often the language translation 00:22:46.460 --> 00:22:49.740 isn't incredible and, as you mentioned, is often 00:22:49.740 --> 00:22:54.880 based on translation bots online. We've got quite 00:22:54.880 --> 00:22:58.690 a few questions coming through. We've had a few, 00:22:58.730 --> 00:23:01.710 because you mentioned about the nature of social 00:23:01.710 --> 00:23:06.230 media as well. Sia Skippy asked, has X's moderation 00:23:06.230 --> 00:23:09.049 of disinformation varied with the nation of origin 00:23:09.049 --> 00:23:11.910 and content of the disinformation? As in, do 00:23:11.910 --> 00:23:14.470 different countries get different and different 00:23:14.470 --> 00:23:17.049 governments get different treatments? And kind 00:23:17.049 --> 00:23:19.869 of mentioned with that, Ozkom said, you've mentioned 00:23:19.869 --> 00:23:21.329 that you've tried to get these accounts banned 00:23:21.329 --> 00:23:23.930 with little effect. What other mitigation opportunities 00:23:23.930 --> 00:23:26.529 do you see? So when you're looking at social 00:23:26.529 --> 00:23:30.720 media, Does moderation change depending on where 00:23:30.720 --> 00:23:34.819 these disinformation campaigns come from? And 00:23:34.819 --> 00:23:39.240 how what other mitigation opportunities do you 00:23:39.240 --> 00:23:42.059 see when banning these individual accounts doesn't 00:23:42.059 --> 00:23:45.240 work? Okay, so I'm not sure if there's if there's 00:23:45.240 --> 00:23:49.460 a difference in terms of in terms of geography, 00:23:49.519 --> 00:23:50.960 like if you do it in this country, or if you 00:23:50.960 --> 00:23:53.730 do it in other country, what I did notice is 00:23:53.730 --> 00:23:57.349 there's a difference in time. So if we find an 00:23:57.349 --> 00:23:59.609 account now and we write on it, I really highly 00:23:59.609 --> 00:24:03.009 doubt whether X will ever delete it. But when 00:24:03.009 --> 00:24:05.609 we were doing this research during the US elections, 00:24:05.890 --> 00:24:08.049 like in the weeks leading up to the actual election, 00:24:08.390 --> 00:24:10.589 and we had a collaboration with Voice of America. 00:24:10.750 --> 00:24:14.750 So Voice of America was just churning out articles 00:24:14.750 --> 00:24:17.230 about this all the time. And back then, we did 00:24:17.230 --> 00:24:20.319 notice that a lot of accounts that they reported 00:24:20.319 --> 00:24:23.299 on actually got deleted, like in the days after 00:24:23.299 --> 00:24:28.279 the article broke. And in some cases where we 00:24:28.279 --> 00:24:30.960 really found that someone was being impersonated, 00:24:30.960 --> 00:24:34.200 for example, and then an ex -spokesperson actually 00:24:34.200 --> 00:24:37.259 came out to say something about this and said 00:24:37.259 --> 00:24:41.779 that they deleted that specific account. So I 00:24:41.779 --> 00:24:45.420 guess at that point, even ex itself realized 00:24:45.420 --> 00:24:47.890 that they had to do something. because otherwise 00:24:47.890 --> 00:24:49.930 there might be too much pressure on them that 00:24:49.930 --> 00:24:54.890 they're not doing anything. And there's other 00:24:54.890 --> 00:24:58.309 accounts like, for example, the pay for repost 00:24:58.309 --> 00:25:00.309 accounts that I mentioned, like the crypto accounts, 00:25:00.509 --> 00:25:03.029 they were banned very, very rapidly. But I think 00:25:03.029 --> 00:25:05.150 that's just like an anti -spam campaign that 00:25:05.150 --> 00:25:07.029 they always have running and it's not necessarily 00:25:07.029 --> 00:25:10.789 related to disinformation. But like those thousands 00:25:10.789 --> 00:25:12.650 of accounts that we found back then, I think 00:25:12.650 --> 00:25:17.160 all of them have been deleted today. So in terms 00:25:17.160 --> 00:25:22.859 of other methods for mitigation, if the platform 00:25:22.859 --> 00:25:31.220 doesn't want to take it down, I don't really 00:25:31.220 --> 00:25:34.819 see another thing that you can do. Maybe if a 00:25:34.819 --> 00:25:37.099 lot of people report it, maybe at some point 00:25:37.099 --> 00:25:40.420 they will do it. I also am very skeptical about 00:25:40.420 --> 00:25:42.779 that. So I think the best thing you can do is 00:25:42.779 --> 00:25:45.339 to just tell other people about it so that everybody 00:25:45.339 --> 00:25:48.680 knows that this kind of this badge exists and 00:25:48.680 --> 00:25:51.740 that people are aware that these kind of accounts 00:25:51.740 --> 00:25:54.380 belong to an influence operation. And that's 00:25:54.380 --> 00:25:57.359 especially relevant right now for Taiwan, where 00:25:57.359 --> 00:25:59.480 so many people are on threats. And right now 00:25:59.480 --> 00:26:01.980 there's so many disinformation going on on threats 00:26:01.980 --> 00:26:04.140 and normal people are seeing it in their daily 00:26:04.140 --> 00:26:08.619 lives and are talking about it at work. Yeah, 00:26:08.640 --> 00:26:10.680 I think just calling it out and calling out that 00:26:10.680 --> 00:26:13.359 this exists can sometimes already be enough. 00:26:14.819 --> 00:26:17.900 Absolutely. We have seen a pattern personally, 00:26:18.619 --> 00:26:20.779 though, at Billingcat, for example, and I know 00:26:20.779 --> 00:26:22.980 a couple of other news organizations have as 00:26:22.980 --> 00:26:26.640 well. When it comes to news impersonation, when 00:26:26.640 --> 00:26:29.900 there's tactics where they're impersonating news 00:26:29.900 --> 00:26:32.200 organizations, for example, calling it out has 00:26:32.200 --> 00:26:35.819 actually given these individual accounts more 00:26:37.069 --> 00:26:40.109 viewership and more engagement. So then they've 00:26:40.109 --> 00:26:42.509 been using that as a tactic. And we've seen an 00:26:42.509 --> 00:26:47.190 outtake in, for example, in terms of the Russian 00:26:47.190 --> 00:26:51.549 disinformation context, people, Russian disinfo 00:26:51.549 --> 00:26:55.589 drivers, emailing and trying to get the attention 00:26:55.589 --> 00:26:58.539 of European fact -checkers, for example, so that 00:26:58.539 --> 00:27:00.819 they can fact -check the content to then drive 00:27:00.819 --> 00:27:04.079 more engagement their way. Interesting model 00:27:04.079 --> 00:27:06.700 that has been working for them and is something 00:27:06.700 --> 00:27:09.440 that we've spoken about in a stage talk before. 00:27:11.059 --> 00:27:14.359 We've got so many questions rolling in. I'm hoping 00:27:14.359 --> 00:27:17.759 I can keep up with them all. Just keeping on 00:27:17.759 --> 00:27:20.160 the social media side and as you were talking 00:27:20.160 --> 00:27:22.779 about the spammer flage, particularly within 00:27:22.779 --> 00:27:25.619 the election that you spoke about, Skirskippy 00:27:25.619 --> 00:27:29.140 asked earlier as well, how many of those followers 00:27:29.140 --> 00:27:34.160 of these accounts are themselves legitimate or 00:27:34.160 --> 00:27:37.000 bots? For example, my experience on Twitter is 00:27:37.000 --> 00:27:39.200 that accounts just naturally accrue totally authentic 00:27:39.200 --> 00:27:41.940 followers at a steady rate. Is there kind of 00:27:41.940 --> 00:27:45.819 a secondary group of bots that are being created 00:27:45.819 --> 00:27:49.619 to amplify those particular tweets or those particular 00:27:49.619 --> 00:27:54.380 posts? Is that part of the plan? Or are these 00:27:54.380 --> 00:27:58.099 real people kind of getting suckered in to kind 00:27:58.099 --> 00:28:01.000 of the propaganda and the messaging? Yes. So 00:28:01.000 --> 00:28:04.440 this is a very important question. And I don't 00:28:04.440 --> 00:28:06.220 know if you're familiar with the breakout skill. 00:28:06.299 --> 00:28:10.559 So this was also developed by Ben Nemo. So the 00:28:10.559 --> 00:28:13.099 breakout skill, basically, when you look at disinformation 00:28:13.099 --> 00:28:16.099 or influence operations, you want to see like, 00:28:16.299 --> 00:28:19.680 did this post break out of its initial bubble. 00:28:19.799 --> 00:28:22.099 And the initial bubble is just an inauthentic 00:28:22.099 --> 00:28:25.039 bubble with just a bunch of fake accounts that 00:28:25.039 --> 00:28:28.039 are following each other and are liking each 00:28:28.039 --> 00:28:31.440 other. And then if it breaks out of that bubble, 00:28:31.759 --> 00:28:34.059 you would be in category two. And if it breaks 00:28:34.059 --> 00:28:36.000 out on multiple platforms, you'd be in category 00:28:36.000 --> 00:28:39.720 three. And then it just keeps going up. So we're 00:28:39.720 --> 00:28:42.339 always trying to look for if these accounts are 00:28:42.339 --> 00:28:46.200 getting authentic interactions from real accounts. 00:28:48.200 --> 00:28:51.240 And it's difficult to look at all the followers. 00:28:52.559 --> 00:28:55.160 It's possible, but if you have these large accounts 00:28:55.160 --> 00:28:57.339 that I mentioned earlier, like these hijacked 00:28:57.339 --> 00:29:00.000 accounts, those are tens of thousands of followers. 00:29:00.140 --> 00:29:02.339 I think it might be somewhat of a waste of time 00:29:02.339 --> 00:29:06.579 to go through all of their followers. So what 00:29:06.579 --> 00:29:08.960 we usually do is we look at the comment section. 00:29:09.640 --> 00:29:11.859 Because the comment section of spammer flash 00:29:11.859 --> 00:29:16.119 accounts are very, let's say, Most of the other 00:29:16.119 --> 00:29:17.960 spam and flash accounts that comment on these 00:29:17.960 --> 00:29:19.940 posts, they all agree. They all say stuff like, 00:29:20.200 --> 00:29:22.960 yes, yes, good point, stuff like that. It's very 00:29:22.960 --> 00:29:25.160 kind of like monotone. But if at some point you 00:29:25.160 --> 00:29:30.740 see replies that disagree with the post, or you 00:29:30.740 --> 00:29:33.319 maybe see replies with people saying stuff like, 00:29:33.339 --> 00:29:35.660 oh, this is weird, or whatever for some reason, 00:29:36.220 --> 00:29:39.599 then you can assume that this post has somehow 00:29:39.599 --> 00:29:42.809 reached authentic users. So I think that's the 00:29:42.809 --> 00:29:48.910 easiest way to see that. Yeah. And then, yeah, 00:29:49.190 --> 00:29:52.950 just a little more on that. So I think they themselves, 00:29:53.269 --> 00:29:55.130 Spammouflage itself is creating more and more 00:29:55.130 --> 00:29:57.990 Spammouflage accounts to then follow all of these 00:29:57.990 --> 00:30:01.109 accounts and also repost them. And then on the 00:30:01.109 --> 00:30:03.009 other hand, I think they're also buying it from 00:30:03.009 --> 00:30:06.170 third party. So like spam companies, they're 00:30:06.170 --> 00:30:13.490 also buying likes and reposts. You mentioned 00:30:13.490 --> 00:30:18.750 that in terms of the propaganda aimed at Taiwanese 00:30:18.750 --> 00:30:22.470 population, that's happening a lot on threads. 00:30:23.049 --> 00:30:25.410 We've actually had a question from Sohan D'Souza 00:30:25.410 --> 00:30:27.430 who's asked, would you please advise regarding 00:30:27.430 --> 00:30:30.170 optimal techniques for threads investigations? 00:30:30.809 --> 00:30:32.950 The advanced search doesn't seem too bad, but 00:30:32.950 --> 00:30:35.490 transparency even via external services seems 00:30:35.490 --> 00:30:38.930 lacking. Could you speak a little bit about how 00:30:38.930 --> 00:30:42.789 the difficulties and the ease of investigating, 00:30:43.109 --> 00:30:45.329 particularly on threads, is that's a new platform 00:30:45.329 --> 00:30:47.789 that many of the researchers, for example, in 00:30:47.789 --> 00:30:51.809 the audience may be new to and want advice on. 00:30:52.170 --> 00:30:56.849 Yeah, sure. So I think one thing that's difficult 00:30:56.849 --> 00:31:00.990 about threads is that everything is new. So sometimes 00:31:00.990 --> 00:31:04.220 when people look for fake accounts on X because 00:31:04.220 --> 00:31:06.839 in most cases, it still are like new accounts, 00:31:06.980 --> 00:31:08.400 right? So you would suddenly see an account that 00:31:08.400 --> 00:31:11.180 was created like three months ago saying all 00:31:11.180 --> 00:31:13.119 this stuff. But then like on threads, it's not 00:31:13.119 --> 00:31:15.059 weird to have an account that was created three 00:31:15.059 --> 00:31:17.500 months ago because everybody is just joining 00:31:17.500 --> 00:31:21.119 this year. But yeah, I think threads is available 00:31:21.119 --> 00:31:23.079 in the content library now if you have access 00:31:23.079 --> 00:31:25.220 to that, but it has a lot of limitations, like 00:31:25.220 --> 00:31:28.559 only certain accounts you will see. So it's not 00:31:28.559 --> 00:31:33.000 very helpful. What I think is a very useful tool 00:31:33.000 --> 00:31:37.579 is there's this add -on that you can get in the 00:31:37.579 --> 00:31:40.720 Chrome store. It's called Single File. And it 00:31:40.720 --> 00:31:45.960 basically just lets you get a .html file of the 00:31:45.960 --> 00:31:48.839 whole page that is currently loaded. So you can 00:31:48.839 --> 00:31:50.819 just go to someone's timeline, and you can scroll 00:31:50.819 --> 00:31:54.420 all the way down, and you can click the add -on. 00:31:54.440 --> 00:31:57.480 And then it will just download a .html file of 00:31:57.480 --> 00:32:00.839 that whole. of that whole page. So that would 00:32:00.839 --> 00:32:04.440 include all the posts, all the images. And what 00:32:04.440 --> 00:32:07.619 you can also do after that is you can write a 00:32:07.619 --> 00:32:10.299 script to organize that data into a data frame. 00:32:10.539 --> 00:32:11.960 So technically speaking, you're not scraping. 00:32:12.119 --> 00:32:15.660 You're not using Selenium and stuff. So Facebook 00:32:15.660 --> 00:32:19.460 won't detect you and ban your account, because 00:32:19.460 --> 00:32:21.900 you're just using this tool to get all of the 00:32:21.900 --> 00:32:24.740 HTML. And then you can do with that data what 00:32:24.740 --> 00:32:29.660 you want after. Another thing that's difficult 00:32:29.660 --> 00:32:34.039 on threads is I found that sometimes certain 00:32:34.039 --> 00:32:37.019 things aren't really working. Like when I try 00:32:37.019 --> 00:32:41.579 to click the account creation date, for example, 00:32:41.619 --> 00:32:44.440 on my laptop, sometimes I get a lot of errors, 00:32:44.519 --> 00:32:46.880 but then when I do it on my phone, it works. 00:32:47.240 --> 00:32:49.519 So I feel like the app works better on your phone 00:32:49.519 --> 00:32:51.559 than it works on your computer, but I'm not doing 00:32:51.559 --> 00:32:55.180 investigations on my phone. And then you also 00:32:55.180 --> 00:32:57.460 have to do a lot of clicks to get there. So it 00:32:57.460 --> 00:33:01.480 just takes a lot of time. Other than that, I 00:33:01.480 --> 00:33:05.380 think I like that it has a keyword search function 00:33:05.380 --> 00:33:09.779 with a recent tab. So I think it looks pretty 00:33:09.779 --> 00:33:12.480 exhaustive like what you have on Twitter. So 00:33:12.480 --> 00:33:16.619 I'm really happy about that. That it's not like 00:33:16.619 --> 00:33:21.660 TikTok. Thanks for that little tip. I've linked 00:33:21.660 --> 00:33:24.660 that in the chat, and I've personally just gone 00:33:24.660 --> 00:33:26.740 and downloaded it. I have a similar one called 00:33:26.740 --> 00:33:30.400 go4page, but that just takes a PNG, so it's good 00:33:30.400 --> 00:33:33.799 to know that there's one for HTML. To say more 00:33:33.799 --> 00:33:35.960 on that, this works for almost every website. 00:33:36.680 --> 00:33:39.519 The only downside is that the .html files are 00:33:39.519 --> 00:33:41.819 very big, so if you get someone's full timeline, 00:33:41.940 --> 00:33:47.000 you might get 100 MB. But yeah, I think it's 00:33:47.000 --> 00:33:49.519 kind of like a half manual, half automated way 00:33:49.519 --> 00:33:51.539 for data collection. It's also a great way to 00:33:51.539 --> 00:33:54.180 archive, right? We all know the trouble of trying 00:33:54.180 --> 00:33:56.420 to archive something with your VPN on and then 00:33:56.420 --> 00:33:58.660 you have to, it just takes ages. But with this 00:33:58.660 --> 00:34:00.319 thing, you can just click it and save it for 00:34:00.319 --> 00:34:01.779 later. And then if the account gets deleted, 00:34:01.940 --> 00:34:04.380 you can just go back to the .html and make your 00:34:04.380 --> 00:34:08.130 screenshots from there. And that's a great time 00:34:08.130 --> 00:34:11.530 for me just to shout that we have a Bellingcat 00:34:11.530 --> 00:34:15.090 auto archiver, which has recently had some updates 00:34:15.090 --> 00:34:18.349 done to it. So please do check that out as well. 00:34:18.690 --> 00:34:23.510 Just linked the guides that in the chat. We've 00:34:23.510 --> 00:34:26.130 had quite a few questions and I'll let you take 00:34:26.130 --> 00:34:30.940 a... Choc? Cool name. It's the most recent question 00:34:30.940 --> 00:34:33.619 to kind of encompass this, but we've had quite 00:34:33.619 --> 00:34:36.699 a few questions about how you spot Chinese Finney 00:34:36.699 --> 00:34:38.539 or Spammelfarge accounts when their activity 00:34:38.539 --> 00:34:42.619 seems to be non -discernible from other Finney 00:34:42.619 --> 00:34:45.400 without an in -depth analysis. Are there any 00:34:45.400 --> 00:34:50.159 telltale signs to spot Spammelfarge accounts, 00:34:51.500 --> 00:34:54.840 specifically Chinese Spammelfarge accounts? Yes, 00:34:55.780 --> 00:34:59.159 so I think some of the things that I just mentioned, 00:34:59.760 --> 00:35:02.679 like for example, that they're mostly active 00:35:02.679 --> 00:35:05.960 during PRC working hours, that is one that you 00:35:05.960 --> 00:35:13.079 can always check. And you can also look at the 00:35:13.079 --> 00:35:15.500 content. So for example, I mentioned a few things 00:35:15.500 --> 00:35:20.199 like specific dissidents or Hong Kong or Xinjiang. 00:35:20.699 --> 00:35:23.380 So these are like... target topics that they 00:35:23.380 --> 00:35:26.679 always focus on. So if it's like a traditional 00:35:26.679 --> 00:35:28.539 spam -a -flash account, it will talk about these 00:35:28.539 --> 00:35:31.179 topics and it's very easy to spot. So you can 00:35:31.179 --> 00:35:34.239 just go to, for example, you can go to People's 00:35:34.239 --> 00:35:38.219 Daily's X account and then just go through its 00:35:38.219 --> 00:35:40.219 repost or look in the comment section and you'll 00:35:40.219 --> 00:35:43.519 find a bunch of spam -a -flash accounts. Now 00:35:43.519 --> 00:35:45.860 it becomes more tricky if the spam -a -flash 00:35:45.860 --> 00:35:48.269 accounts are like these mega -flash. type of 00:35:48.269 --> 00:35:50.170 accounts, right? So they're not posting all of 00:35:50.170 --> 00:35:52.489 this traditional pro PRC stuff. And you might 00:35:52.489 --> 00:35:54.250 think like, oh, this could be, this could be 00:35:54.250 --> 00:35:58.130 anyone running this influence operation. So how 00:35:58.130 --> 00:36:02.150 we attributed those accounts to spamouflage is 00:36:02.150 --> 00:36:05.730 by looking at the people who amplify it. So that's 00:36:05.730 --> 00:36:07.630 where these kind of weird crypto accounts came 00:36:07.630 --> 00:36:11.090 in. So we noticed that these accounts were amplifying 00:36:11.090 --> 00:36:14.480 a lot of spamouflage and then suddenly like right 00:36:14.480 --> 00:36:16.860 before the election, like five days before the 00:36:16.860 --> 00:36:18.800 election, just all these new accounts were created 00:36:18.800 --> 00:36:22.519 that criticize specific lawmakers. And they only 00:36:22.519 --> 00:36:25.760 had three posts and nothing else. But when we 00:36:25.760 --> 00:36:28.260 looked at the reposts, we saw that there was 00:36:28.260 --> 00:36:30.760 actually quite some overlap with the accounts 00:36:30.760 --> 00:36:33.900 that amplify the traditional spam of flash and 00:36:33.900 --> 00:36:36.079 also PRC state media accounts. So that's how 00:36:36.079 --> 00:36:39.719 we were able to attribute it. There's also more 00:36:39.719 --> 00:36:43.159 on that in our US election observation report, 00:36:43.159 --> 00:36:46.360 if you're interested. And I highly recommend 00:36:46.360 --> 00:36:50.079 anyone to just read a lot of papers about spamouflage, 00:36:50.139 --> 00:36:53.880 and you will see a lot of account characteristics 00:36:53.880 --> 00:36:57.440 that you can use to find them. And once you find 00:36:57.440 --> 00:37:00.219 a few, you can just keep snowballing. Someone 00:37:00.219 --> 00:37:05.159 asked earlier actually in the chat, in the election 00:37:05.159 --> 00:37:08.869 coverage that you saw, were they... only promoting 00:37:08.869 --> 00:37:16.190 Trump rhetoric, or was it a little bit more broader 00:37:16.190 --> 00:37:18.630 across the political spectrum? They also asked, 00:37:18.769 --> 00:37:22.409 have you seen any similar campaigns targeting 00:37:22.409 --> 00:37:25.550 European politicians, for example? For example, 00:37:25.710 --> 00:37:27.889 last year was a huge election year across the 00:37:27.889 --> 00:37:31.449 world. Have you seen any similar trends in terms 00:37:31.449 --> 00:37:36.800 of European elections? So first, on the first 00:37:36.800 --> 00:37:41.719 question, most of the traditional spam camouflage 00:37:41.719 --> 00:37:45.920 accounts were anti -everything. They did say 00:37:45.920 --> 00:37:48.159 a few things that maybe aligned more with Trump. 00:37:48.260 --> 00:37:51.400 So they were, for example, a bit more, well, 00:37:51.619 --> 00:37:55.139 they're anti -U .S. support for Ukraine, which 00:37:55.139 --> 00:37:57.900 maybe you think that, okay, maybe that's more 00:37:57.900 --> 00:38:00.059 closely connected to what Trump is saying. There 00:38:00.059 --> 00:38:03.980 were also critical of the LGTBQ movement. So 00:38:03.980 --> 00:38:06.739 maybe you can also draw some connections there. 00:38:07.059 --> 00:38:09.860 But with the mega flush account, specifically 00:38:09.860 --> 00:38:12.920 the accounts that are really pushing Trump, we 00:38:12.920 --> 00:38:15.920 only found that for Trump. We didn't find similar 00:38:15.920 --> 00:38:20.179 accounts that were supporting Biden. One interesting 00:38:20.179 --> 00:38:23.079 thing, though, is that basically all of the spam 00:38:23.079 --> 00:38:25.500 flush accounts that we were tracking were very 00:38:25.500 --> 00:38:30.460 anti LGTBQ. And then like those five days before 00:38:30.460 --> 00:38:32.360 the election, when these accounts were created 00:38:32.360 --> 00:38:35.420 that criticize specific lawmakers, they were 00:38:35.420 --> 00:38:38.840 criticizing Republican lawmakers for being anti 00:38:38.840 --> 00:38:41.880 -LGBTQ. So that's just a completely different 00:38:41.880 --> 00:38:45.239 standpoint kind of playing both sides. So that 00:38:45.239 --> 00:38:49.699 was it was interesting to see that. And for Europe, 00:38:49.699 --> 00:38:54.260 I haven't really been tracking the European election 00:38:54.260 --> 00:38:57.550 season and also the accounts that I was tracking, 00:38:57.650 --> 00:39:01.710 it was more quiet about the European elections, 00:39:01.769 --> 00:39:04.949 but I'm pretty sure that some stuff did go on. 00:39:05.590 --> 00:39:07.949 Maybe that's something our community can have 00:39:07.949 --> 00:39:11.070 a look into. Something to track, guys. A little 00:39:11.070 --> 00:39:15.550 homework for you all. You mentioned earlier that 00:39:15.550 --> 00:39:22.519 often they use images of influencers. as part 00:39:22.519 --> 00:39:24.880 of the accounts, they might not be aware, these 00:39:24.880 --> 00:39:27.360 influencers might not be aware that their images 00:39:27.360 --> 00:39:30.139 are being used or it's being used without their 00:39:30.139 --> 00:39:33.710 consent or their control. Do you also see a trend 00:39:33.710 --> 00:39:36.989 of proxy actors or self -interested actors helping 00:39:36.989 --> 00:39:39.849 to boost propaganda narratives in Asia, particularly? 00:39:40.170 --> 00:39:42.889 For example, social media influencers peddling 00:39:42.889 --> 00:39:45.630 Chinese state lands. I think on your website, 00:39:46.150 --> 00:39:50.170 it might attend economic capital owners or suitors. 00:39:50.690 --> 00:39:53.630 Is there any pattern to there to what these influences 00:39:53.630 --> 00:39:57.210 look like, say, or do they kind of transcend 00:39:57.210 --> 00:40:01.030 algorithmic communities if they do exist? Yeah, 00:40:01.269 --> 00:40:05.130 so one of our partners actually wrote a big article 00:40:05.130 --> 00:40:10.190 on that. That's also on our medium. And she found 00:40:10.190 --> 00:40:13.369 that on WeChat, so now you have these WeChat 00:40:13.369 --> 00:40:17.010 stories, and she found that there were a lot 00:40:17.010 --> 00:40:22.280 of influencers. Chinese and also Taiwanese influencers, 00:40:22.280 --> 00:40:25.300 like living in Taiwan, who would then post a 00:40:25.300 --> 00:40:29.440 lot of very pro PRC narratives. So to say like, 00:40:29.920 --> 00:40:33.599 oh, Taiwan should join China and that kind of 00:40:33.599 --> 00:40:38.400 stuff. But the conclusion there was that she 00:40:38.400 --> 00:40:40.760 believes that they were only saying these things 00:40:40.760 --> 00:40:43.239 because they know that they might be boosted 00:40:43.239 --> 00:40:45.639 by the algorithm for saying that. And then they 00:40:45.639 --> 00:40:48.980 were all running these online shops on the side. 00:40:49.210 --> 00:40:52.510 And this is interesting because we found a similar 00:40:52.510 --> 00:40:56.269 thing on TikTok. I think Voice of America also 00:40:56.269 --> 00:41:00.630 wrote an article about that, where we found these 00:41:00.630 --> 00:41:03.010 accounts that were kind of operated, seen from 00:41:03.010 --> 00:41:07.349 out of Singapore, and they were AI avatars, often 00:41:07.349 --> 00:41:11.550 of Western -looking women or Russian or Ukrainian 00:41:11.550 --> 00:41:13.670 women. I think that's how it kind of started. 00:41:14.010 --> 00:41:18.260 And they would start by giving this pro PRC propaganda 00:41:18.260 --> 00:41:20.280 talk and then like halfway through the video 00:41:20.280 --> 00:41:22.940 they would suddenly start promoting these vitamin 00:41:22.940 --> 00:41:27.000 products and it's just so weird but there's this 00:41:27.000 --> 00:41:29.780 this theory that these videos were maybe originally 00:41:29.780 --> 00:41:33.000 made for PRC social media and they think like 00:41:33.000 --> 00:41:34.920 oh if we post this kind of stuff the narrative 00:41:34.920 --> 00:41:37.579 that the algorithm will push us because that's 00:41:37.579 --> 00:41:40.090 what That's what Xi Jinping wants us to say. 00:41:40.730 --> 00:41:44.329 And then we use that to then sell our products. 00:41:44.489 --> 00:41:46.230 But this is still kind of like a hypothesis. 00:41:46.349 --> 00:41:48.750 But we did find this in multiple different places. 00:41:49.630 --> 00:41:54.210 That's really interesting. Yeah, I haven't seen 00:41:54.210 --> 00:41:58.150 it linked with political comment, but I've definitely 00:41:58.150 --> 00:42:03.130 seen news influences. fake ones, using a news 00:42:03.130 --> 00:42:06.150 hub to then go and sell a well -being product, 00:42:06.150 --> 00:42:09.010 for example. It's really interesting that that's 00:42:09.010 --> 00:42:11.269 a tactic that they might be using, particularly 00:42:11.269 --> 00:42:13.949 on TikTok. Thanks for sharing. And I've linked, 00:42:14.130 --> 00:42:16.630 I think, is it called Patriotism for Sale, the 00:42:16.630 --> 00:42:20.050 WeChat one? Yes, yeah, that's the one. I've linked 00:42:20.050 --> 00:42:24.849 that within the chat. Do check out DoubleThink 00:42:24.849 --> 00:42:28.250 Labs' medium, by the way. It's full of incredible 00:42:28.250 --> 00:42:32.230 information. Hania Reyes just put, I've seen 00:42:32.230 --> 00:42:34.190 hacked influencer accounts start to sell products 00:42:34.190 --> 00:42:38.869 on TikTok too. Mashtar said maybe they modeled 00:42:38.869 --> 00:42:42.389 some of it off Alex Jones info walls as they 00:42:42.389 --> 00:42:46.050 were pushing vitamins. Somebody's just dropped 00:42:46.050 --> 00:42:48.630 your DoubleThinkLab medium in the chat as well. 00:42:48.750 --> 00:42:51.449 That's really cool. Thank you for doing that. 00:42:51.929 --> 00:42:54.309 Still so many questions coming in. You mentioned 00:42:54.309 --> 00:43:00.130 the big... the big term AI in your last answer, 00:43:00.550 --> 00:43:02.570 could you tell us a little bit more about how 00:43:02.570 --> 00:43:07.210 AI is being used in influence operations going 00:43:07.210 --> 00:43:10.889 forwards and is that a new phenomenon or has 00:43:10.889 --> 00:43:15.289 it been going on for a few years? I think right 00:43:15.289 --> 00:43:20.269 now the thing that AI, that people are most afraid 00:43:20.269 --> 00:43:24.010 of with AI are not are not really happening yet, 00:43:24.150 --> 00:43:26.590 at least with PRC influence operations. It feels 00:43:26.590 --> 00:43:29.590 like they are kind of experimenting with it. 00:43:30.050 --> 00:43:33.130 So I kind of divide it up for myself. I think 00:43:33.130 --> 00:43:35.090 AI is being used in four different ways. Now, 00:43:35.090 --> 00:43:38.010 the first one is AI that is being used to deceive, 00:43:38.230 --> 00:43:41.010 right? So you're trying to create photos or videos 00:43:41.010 --> 00:43:43.389 that look real, but actually they're fake. And 00:43:43.389 --> 00:43:49.139 you're really trying to fool people. I changed 00:43:49.139 --> 00:43:51.440 their perception of things through these fake 00:43:51.440 --> 00:43:55.900 videos or photos. And so far from the PRC influence 00:43:55.900 --> 00:43:59.820 operations, I have not really seen that. Most 00:43:59.820 --> 00:44:04.960 of the use of AI has been AI to convey a certain 00:44:04.960 --> 00:44:09.300 idea. So they would, for example, create an AI 00:44:09.300 --> 00:44:13.039 generated image of, I don't know, like Trump 00:44:13.039 --> 00:44:15.159 and Netanyahu kissing or something like that. 00:44:15.400 --> 00:44:18.280 And that would be like everybody knows that that 00:44:18.280 --> 00:44:20.920 this is fake, right? It's very obvious, but it's 00:44:20.920 --> 00:44:26.000 being used to get this idea out there, get this 00:44:26.000 --> 00:44:27.739 visualization. I guess it's just a replacement 00:44:27.739 --> 00:44:30.179 for a cartoon if you don't have time to draw 00:44:30.179 --> 00:44:34.079 a cartoon yourself. And then there is another 00:44:34.079 --> 00:44:36.579 method, which is also interesting, and that's 00:44:36.579 --> 00:44:40.800 AI as a technical assistant. So for example, 00:44:41.019 --> 00:44:45.889 we found Also, in the US election, we found that 00:44:45.889 --> 00:44:48.349 some accounts, like a few days before the election, 00:44:48.510 --> 00:44:52.429 they suddenly uploaded a video and it was like 00:44:52.429 --> 00:44:56.449 speech in English and then some stock images 00:44:56.449 --> 00:44:59.590 in the back. But we actually found that the speech 00:44:59.590 --> 00:45:03.829 originates from a Baidu post in Chinese, like 00:45:03.829 --> 00:45:07.199 an essay that someone posted. And yeah, we highly 00:45:07.199 --> 00:45:09.780 suspect that they used AI to translate and then 00:45:09.780 --> 00:45:13.440 also use text to speech AI to create the voice 00:45:13.440 --> 00:45:16.900 to say this. So this opens up a lot of possibilities. 00:45:17.219 --> 00:45:20.139 Right. So they can now just get any any data 00:45:20.139 --> 00:45:23.039 from the Chinese cyberspace and just turn it 00:45:23.039 --> 00:45:27.420 into a spoken like perfectly spoken English audio 00:45:27.420 --> 00:45:30.800 fragment and just put it on Western social media. 00:45:31.530 --> 00:45:34.070 There was something similar in Taiwan during 00:45:34.070 --> 00:45:38.949 the election, so someone made a PRC threat actor 00:45:38.949 --> 00:45:41.929 wrote this book about Tsai Ing -wen, the previous 00:45:41.929 --> 00:45:44.329 president, and they called it The Secret History 00:45:44.329 --> 00:45:47.690 of Tsai Ing -wen, which is just a book full of 00:45:47.690 --> 00:45:49.710 nonsense about Tsai Ing -wen. And then they got 00:45:49.710 --> 00:45:53.110 all of these AI avatars that they got made with 00:45:53.110 --> 00:45:55.610 CapCut, so I think that belongs to ByteDance, 00:45:55.989 --> 00:46:00.789 and they made all these AI avatars. to narrate 00:46:00.789 --> 00:46:03.570 the book in kind of like a newsroom setting. 00:46:04.349 --> 00:46:08.949 So yeah, just kind of using these AI tools to 00:46:08.949 --> 00:46:11.809 very quickly get certain information out there. 00:46:12.170 --> 00:46:16.889 And I think the most scary one, which is like 00:46:16.889 --> 00:46:19.429 AI for full automation, which is the thing that 00:46:19.429 --> 00:46:22.550 I am most afraid of, we've seen accounts experimenting 00:46:22.550 --> 00:46:25.090 with it. Like we've seen posts, even posts by, 00:46:25.230 --> 00:46:28.739 for example, Zhang Heqing, like the former the 00:46:28.739 --> 00:46:31.400 former PRC diplomat. He has a lot of posts that 00:46:31.400 --> 00:46:34.159 look a lot like they were AI generated. And I 00:46:34.159 --> 00:46:36.340 think that that's where it becomes really scary 00:46:36.340 --> 00:46:38.300 because that's the moment where you can just 00:46:38.300 --> 00:46:43.820 create 10 ,000 bots and give them a wide range 00:46:43.820 --> 00:46:45.599 of prompts. You can give them guidelines and 00:46:45.599 --> 00:46:48.659 they just can create original content all the 00:46:48.659 --> 00:46:52.320 time and it just won't stop. And especially because 00:46:52.320 --> 00:46:55.199 OpenAI, like in February, they released their 00:46:55.199 --> 00:46:58.320 newest report in which they found that PRC threat 00:46:58.320 --> 00:47:03.420 actors were using JetGBT to create critical comments 00:47:03.420 --> 00:47:09.679 of certain dissidents. Then you can just unleash 00:47:09.679 --> 00:47:13.400 an army of 10 ,000 bots on one person, especially 00:47:13.400 --> 00:47:16.659 if you have a model that you can locally run. 00:47:16.820 --> 00:47:19.199 This is what I'm most afraid of, but it hasn't 00:47:19.199 --> 00:47:24.300 really happened yet. Thanks so much for explaining 00:47:24.300 --> 00:47:27.500 some of the tactics that they take in terms of 00:47:27.480 --> 00:47:32.260 AI. In regards to other questions, Mini Joyce 00:47:32.260 --> 00:47:35.340 has asked, what are the odds China uses cyber 00:47:35.340 --> 00:47:37.860 capabilities to bolster their Femi operations? 00:47:38.179 --> 00:47:40.960 I mean, more than they already do. Is there a 00:47:40.960 --> 00:47:45.179 sense where they're using cyber capabilities 00:47:45.179 --> 00:47:48.000 to bolster the reach of these kinds of operations? 00:47:49.340 --> 00:47:53.960 I think that is definitely possible at some point, 00:47:53.960 --> 00:47:58.130 especially if If you start looking at full automation 00:47:58.130 --> 00:48:00.650 that I was just talking about, I think at that 00:48:00.650 --> 00:48:03.630 point, they could definitely tap into some of 00:48:03.630 --> 00:48:08.190 the cyber resources that they have. But I also 00:48:08.190 --> 00:48:14.110 think that you would maybe see this on creating 00:48:14.110 --> 00:48:16.510 news websites and stuff like that. I think you 00:48:16.510 --> 00:48:19.909 would see it would be more prominent there than 00:48:19.909 --> 00:48:22.690 on social media accounts. And yeah, of course, 00:48:22.889 --> 00:48:27.519 they have Yeah, you have the rise of PRC platforms 00:48:27.519 --> 00:48:32.260 right now. So yeah, TikTok and also Xiaolongsu, 00:48:32.760 --> 00:48:35.659 like Red Note. People have also started downloading 00:48:35.659 --> 00:48:38.460 that. And of course, there's also a lot of, I 00:48:38.460 --> 00:48:41.320 think, embedded influence operation going on 00:48:41.320 --> 00:48:44.980 within these apps with pushing certain content 00:48:44.980 --> 00:48:48.079 and suppressing other content in the same way 00:48:48.079 --> 00:48:52.500 that happens on Weibo or like the really proper 00:48:52.500 --> 00:48:56.420 PRC platforms. So they're definitely using their 00:48:56.420 --> 00:49:00.239 cyber capabilities there. As you asked earlier, 00:49:00.260 --> 00:49:03.699 and this goes back to kind of people in the audience, 00:49:03.760 --> 00:49:05.760 for example, who might be interested in getting 00:49:05.760 --> 00:49:08.900 involved in all of this. What research, what 00:49:08.900 --> 00:49:12.599 resources slash learning platform slash certifications 00:49:12.599 --> 00:49:15.079 would you recommend someone trying to get into 00:49:15.079 --> 00:49:19.960 the field of FEME? I think the field of FEME 00:49:19.960 --> 00:49:25.659 is kind of Well, it's maybe similar to OSINT 00:49:25.659 --> 00:49:29.260 in general, but the field of FMI, most of the 00:49:29.260 --> 00:49:32.079 analysts, especially at a double think lab, all 00:49:32.079 --> 00:49:34.500 come from kind of like a political science background. 00:49:34.940 --> 00:49:38.179 I also have like a background in Chinese studies 00:49:38.179 --> 00:49:41.500 and Asia Pacific studies. And then I learned 00:49:41.500 --> 00:49:44.679 some coding and some data science, but we also 00:49:44.679 --> 00:49:46.519 have an engineering team that can really help 00:49:46.519 --> 00:49:51.500 us with more of the technical things. But I think 00:49:51.500 --> 00:49:55.900 just some basic Python, especially pandas, could 00:49:55.900 --> 00:49:58.960 be very useful. Because, for example, when we 00:49:58.960 --> 00:50:03.380 write algorithms to detect coordinated inauthentic 00:50:03.380 --> 00:50:05.960 behavior, we look a lot at, for example, post 00:50:05.960 --> 00:50:10.360 similarity. And the time between posts is also 00:50:10.360 --> 00:50:14.119 very important. So if you can very quickly. kind 00:50:14.119 --> 00:50:17.440 of like manipulate the data to find similar posts 00:50:17.440 --> 00:50:20.260 using certain Python packages and also find posts, 00:50:20.699 --> 00:50:23.760 batch posts that were done in very rapid succession, 00:50:24.239 --> 00:50:26.920 then that is definitely very helpful. I guess 00:50:26.920 --> 00:50:29.820 if you're very good with Excel, you can also 00:50:29.820 --> 00:50:33.280 do all of that stuff. I don't necessarily think 00:50:33.280 --> 00:50:39.280 you need any certification. or specific certification. 00:50:40.159 --> 00:50:45.059 At least I don't really have that. But I do recommend 00:50:45.059 --> 00:50:49.079 that you just read as much research as possible 00:50:49.079 --> 00:50:52.679 from, for example, DoubleThink Lab or DFR Lab 00:50:52.679 --> 00:50:56.599 or Microsoft Threat Intelligence. You also have 00:50:56.599 --> 00:50:59.239 Google is also doing research in all of this. 00:50:59.360 --> 00:51:01.639 There's so many parties out there that have researched 00:51:01.639 --> 00:51:06.219 spamouflage before. And yeah, you can kind of 00:51:06.570 --> 00:51:11.489 imitate or copy their research methods. And as 00:51:11.489 --> 00:51:14.449 a reminder, you can always ask for support and 00:51:14.449 --> 00:51:18.690 help within this survey as well. lots of channels 00:51:18.690 --> 00:51:20.630 for that, which I'm sure the mods can point you 00:51:20.630 --> 00:51:24.750 to. Particularly when it comes to covering China 00:51:24.750 --> 00:51:27.650 specifically, we have region -specific channels 00:51:27.650 --> 00:51:30.929 as well where you can debate and talk about the 00:51:30.929 --> 00:51:34.769 current news and current investigations. We've 00:51:34.769 --> 00:51:37.250 also had a recommendation by somebody to check 00:51:37.250 --> 00:51:39.409 out Sam Cooper's work. We'll go on Chinese interference. 00:51:39.630 --> 00:51:41.750 There's a Canadian journalist who's uncovered 00:51:41.750 --> 00:51:46.809 quite a bit about Chinese influence and interference 00:51:46.809 --> 00:51:50.510 in Canada specifically. Do you, Jasper, do you 00:51:50.510 --> 00:51:52.909 have any other recommendations for investigative 00:51:52.909 --> 00:51:55.989 journalists perhaps that our team, our audience 00:51:55.989 --> 00:51:58.730 could look at? I'm sorry, what do you mean precisely? 00:51:59.349 --> 00:52:01.809 In regards to journalists within the space as 00:52:01.809 --> 00:52:04.670 well, as you mentioned the organizations that 00:52:04.670 --> 00:52:06.789 are working within the space or any journalists 00:52:06.789 --> 00:52:09.409 that also stand out to you that are working within 00:52:09.409 --> 00:52:11.750 this space and highlighting Chinese influence 00:52:11.750 --> 00:52:15.389 operations. Yeah, so I've worked very closely 00:52:15.389 --> 00:52:22.590 together with Wenhao Ma from VOA. So, yeah, he 00:52:22.590 --> 00:52:28.190 has a sub stack and I'm sure he will lend a nice 00:52:28.190 --> 00:52:30.150 job again soon and he will keep reporting on 00:52:30.150 --> 00:52:33.210 it. But I think his China reporting has been 00:52:33.210 --> 00:52:36.010 really good and he very often also touches on 00:52:36.010 --> 00:52:40.869 issues related to influence operations. So I 00:52:40.869 --> 00:52:43.210 definitely recommend following him. And then 00:52:43.210 --> 00:52:46.949 there is some other, it's not really journalists, 00:52:47.090 --> 00:52:50.070 but it's more like researchers also. So it's 00:52:50.070 --> 00:52:52.889 called discourse power. It's also this sub stack. 00:52:54.070 --> 00:52:57.050 And they also write a lot of excellent stuff 00:52:57.050 --> 00:53:01.250 that also touches a lot on PRC influence operations, 00:53:01.449 --> 00:53:06.130 but also PRC propaganda in general. Amazing, 00:53:06.289 --> 00:53:08.449 getting so many reading recommendations right 00:53:08.449 --> 00:53:11.190 now. Thank you. I've put both of those within 00:53:11.190 --> 00:53:15.989 the chat. We only have five minutes left, so 00:53:15.989 --> 00:53:19.510 I just want to make sure that we've covered everyone's 00:53:19.510 --> 00:53:22.949 questions. We had a question earlier particularly 00:53:22.949 --> 00:53:27.250 about the influence of Chinese operations or 00:53:27.250 --> 00:53:31.730 digital operations in Africa. Are you familiar 00:53:31.730 --> 00:53:37.349 with any large scale influence campaigns by the 00:53:37.349 --> 00:53:40.130 PRC, for example, on the African continent? And 00:53:40.130 --> 00:53:42.849 does that differ to their attempts, for example, 00:53:42.949 --> 00:53:50.250 in Taiwan or in America? So far, I haven't seen, 00:53:51.210 --> 00:53:53.750 I haven't really been tracking a lot of Africa 00:53:53.750 --> 00:53:57.949 focused influence operations yet. I'm sure that 00:53:57.949 --> 00:54:03.659 they They do exist, but in the account pool that 00:54:03.659 --> 00:54:06.219 we've been tracking over the last few months, 00:54:06.920 --> 00:54:13.519 Africa rarely popped up. I would say that countries 00:54:13.519 --> 00:54:19.820 like the Philippines and Japan are a bigger topic. 00:54:20.059 --> 00:54:22.920 Also now, obviously, India and Pakistan, that's 00:54:22.920 --> 00:54:26.480 a very hot topic right now for these accounts. 00:54:28.369 --> 00:54:31.210 As an African, we start to see a lot of Chinese 00:54:31.210 --> 00:54:35.510 projects here, mostly in France. Fabulous. Great. 00:54:36.630 --> 00:54:38.989 Well, thank you so much, Jasper, for your time 00:54:38.989 --> 00:54:43.449 today. I wanted to just wrap up with a final, 00:54:43.449 --> 00:54:47.889 final question, if that's okay. What tools are 00:54:47.889 --> 00:54:50.969 absolutely vital to your deep dive research in 00:54:50.969 --> 00:54:53.429 general? You mentioned a couple of threads earlier, 00:54:53.449 --> 00:54:56.090 but which ones are absolutely vital to them? 00:54:56.110 --> 00:54:58.909 research that you do. We like to leave people 00:54:58.909 --> 00:55:01.610 with some kind of key resources to look into. 00:55:02.909 --> 00:55:04.829 But other than that, thank you very much for 00:55:04.829 --> 00:55:07.429 joining. And yeah, thank you everybody for listening. 00:55:08.190 --> 00:55:11.570 Yeah, if you can just throw some tools away and 00:55:11.570 --> 00:55:15.250 then we'll wrap. Yeah, so I really my single 00:55:15.250 --> 00:55:18.230 most important tool is single file. If you don't 00:55:18.230 --> 00:55:22.139 have access to official APIs or you don't have 00:55:22.139 --> 00:55:26.440 access to any scrapers, you can use single file. 00:55:26.639 --> 00:55:29.480 And if you have a little bit of Python or a chat 00:55:29.480 --> 00:55:32.340 GPT account, then you can figure it out and you 00:55:32.340 --> 00:55:35.780 can basically get any data and put it into a 00:55:35.780 --> 00:55:39.500 neat data format and then analyze it. So yeah, 00:55:39.739 --> 00:55:45.110 definitely just single file. I think we're going 00:55:45.110 --> 00:55:47.489 to have to start a little Python learning group. 00:55:49.050 --> 00:55:51.469 I know quite a few people know it, but I think 00:55:51.469 --> 00:55:54.630 we should start a little one -up in the Discord 00:55:54.630 --> 00:55:58.389 server and work together on that. Thanks so much 00:55:58.389 --> 00:56:00.789 for sharing Single File as a resource for us, 00:56:00.869 --> 00:56:04.969 and thanks again for joining us on this particular... 00:56:05.309 --> 00:56:09.110 talk. It's been super fascinating and hope to 00:56:09.110 --> 00:56:11.929 see you back in the Discord server again soon. 00:56:12.269 --> 00:56:15.590 Thanks so much, Jesper. Thank you for having 00:56:15.590 --> 00:56:20.590 me. Thank you, everybody. Thank you for listening 00:56:20.590 --> 00:56:23.690 to the stage talk. If you'd like to catch a stage 00:56:23.690 --> 00:56:26.829 tour live where you can ask the guest questions, 00:56:27.329 --> 00:56:30.170 join the Bellingcat Discord server by visiting 00:56:30.170 --> 00:56:36.250 www .discord .gg slash Bellingcat. The music 00:56:36.250 --> 00:56:39.730 you've heard is titled Dawn by Newer Self and 00:56:39.730 --> 00:56:41.389 is courtesy of Artlist.